IPA warns of upcoming PHP security release
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
IPA advises preparing for a PHP security release fixing two vulnerabilities affecting PHP 5+, not yet confirmed exploited in the wild.
The Information-technology Promotion Agency (IPA) of Japan issued a pre-alert advising organizations to prepare for an upcoming PHP Group security release addressing two vulnerabilities, scheduled for publication on October 21, 2026 at 23:00 JST. As of the advisory's publication, no patches, detailed affected version ranges, or fixed versions have been released, and IPA states it has not confirmed any in-the-wild exploitation of these flaws.
CERT-EU has referenced these issues under the identifiers CVE-2026-109618 and CVE-2026-109619, noting that PHP 5 and later are affected. IPA notes that PHP is used not only directly in web applications but is often embedded within software products and network devices, where its presence may not be visible to end users; organizations are urged to check vendor documentation and security bulletins for PHP usage in deployed products.
IPA recommends that website operators and developers inventory their use of PHP wherever feasible and prepare to apply the forthcoming patches as soon as they are released, citing past rapid exploitation patterns following PHP vulnerability disclosures (referencing a prior 2024 advisory on exploited PHP vulnerabilities). IPA specifically flags continued use of end-of-life PHP versions as a risk factor, warning that attackers may move to exploit these vulnerabilities very quickly after release details become public.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/pre-alert20261021.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,739 reports from 144 sources, 497 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs